Over a million developers have joined DZone.
{{announcement.body}}
{{announcement.title}}

Docker Registry With a Let's Encrypt Certificate

DZone's Guide to

Docker Registry With a Let's Encrypt Certificate

Save the whales! Learn how to protect your Docker files from pesky container security threats by generating an encryption certificate.

· Security Zone
Free Resource

Discover an in-depth knowledge about the different kinds of iOS hacking tools and techniques with the free iOS Hacking Guide from Security Innovation.

A one-liner to run an SSL Docker registry generating a Let's Encrypt certificate.

This command will create a registry proxying the Docker hub, caching the images in a registry volume.

A Lets' Encrypt certificate will be auto-generated and stored in the host directory as letsencrypt.json. You could also use a Docker volume to store it.

In order for the certificate generation to work, the registry needs to be accessible from the internet in port 443. After the certificate is generated that's no longer needed.

docker run -d -p 443:5000 --name registry \
  -v `pwd`:/etc/docker/registry/ \
  -v registry:/var/lib/registry \
  -e REGISTRY_HTTP_ADDR=0.0.0.0:5000 \
  -e REGISTRY_HTTP_HOST=https://docker.example.com \
  -e REGISTRY_HTTP_TLS_LETSENCRYPT_CACHEFILE=/etc/docker/registry/letsencrypt.json \
  -e REGISTRY_HTTP_TLS_LETSENCRYPT_EMAIL=admin@example.com \
  -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \
  registry:2

You can also create a config.yml in this directory and run the registry using the file instead of environment variables.

version: 0.1
storage:
  filesystem:
http:
  addr: 0.0.0.0:5000
  host: https://docker.example.com
  tls:
    letsencrypt:
      cachefile: /etc/docker/registry/letsencrypt.json
      email: admin@example.com
proxy:
  remoteurl: https://registry-1.docker.io

Then run:

docker run -d -p 443:5000 --name registry \
  -v `pwd`:/etc/docker/registry/ \
  -v registry:/var/lib/registry \
  registry:2

If you want to use this as a remote repository and not just for proxying, remove the proxy entry in the configuration.

Learn about the importance of a strong culture of cybersecurity, and examine key activities for building – or improving – that culture within your organization.

Topics:
security ,docker security ,ssl certificates ,cloud security ,container security

Published at DZone with permission of Carlos Sanchez, DZone MVB. See the original article here.

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}